{"id":"CVE-2026-119644","title":"Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints","summary":"Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/ba…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-639"],"vendor":"blossom-editor","product":"Blossom","affected":["Blossom <= 1.17.1"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:30:11.430575Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:30:31.603Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119644","references":[{"url":"https://github.com/blossom-editor/blossom/issues/214"},{"url":"https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureService.java#L222-L232"},{"url":"https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureController.java#L56-L109"},{"url":"https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete"},{"url":"https://github.com/blossom-editor/blossom"},{"url":"https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-picture-delete-and-star-endpoints","label":"VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints"}],"tags":["cve.org","exploit-available"],"epss":0.00326,"epssPercentile":0.25784,"ingestedAt":"2026-11-05T16:07:30.284Z","slug":"CVE-2026-119644","body":"## Overview\n\nBlossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.\n\n## Affected\n\n- `Blossom <= 1.17.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":234879,"id":"CVE-2026-119644","ts":1793918465874,"field":"exploit_available","old":"false","new":"true"}]}